Security audit

alibabacloud-cms-manage

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent Alibaba Cloud monitoring helper, but it includes high-impact cloud and Kubernetes actions with under-scoped confirmation and unsafe credential/installer handling that users should review carefully.

Install only if you are comfortable letting the agent guide Alibaba Cloud and Kubernetes monitoring changes. Use a least-privilege Alibaba Cloud profile, require explicit confirmation before any create/update/delete/patch, avoid running `curl | bash` or HTTP agent downloads unless you independently verify the source and checksum, and keep APM tokens and kubeconfig files out of chat logs and persistent shared paths.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (3)

T08 · Insecure Dependencies

Error

Location: references/apm.md:311
Finding: Java monitoring agent is downloaded over unauthenticated HTTP and executed
Content: View full analysis
Vulnerability Details

File Location: references/apm.md:311-316, 377-401
Vulnerability Type: Unauthenticated remote dependency retrieval
Risk Level: High

Vulnerable Code

markdown
### Agent Download URL Pattern | Network | URL Pattern | |---------|-------------| | Public | `http://arms-apm-{regionId}.oss-{regionId}.aliyuncs.com/<path>` | | VPC | `http://arms-apm-{regionId}.oss-{regionId}-internal.aliyuncs.com/<path>` |

bash
## Java — AliyunJavaAgent (Manual Install) ### 1. Download Agent wget -T 30 -t 3 "http://arms-apm-{regionId}.oss-{regionId}[-internal].aliyuncs.com/AliyunJavaAgent.zip" -O AliyunJavaAgent.zip unzip AliyunJavaAgent.zip -d /opt/ ### 2. Startup Configuration java -javaagent:/opt/AliyunJavaAgent/aliyun-java-agent.jar \ -Darms.licenseKey={LicenseKey} \ -Darms.appName={appName} \ -Darms.workspace={workspace} \ -jar app.jar

Technical Analysis

The onboarding instructions retrieve AliyunJavaAgent.zip over plaintext HTTP. HTTP provides neither server authentication nor transport integrity. The workflow does not verify a cryptographic signature, certificate-backed manifest, or pinned digest before extracting the archive into /opt.

The downloaded JAR is subsequently passed to the JVM through -javaagent. Java agents execute inside the target JVM and can instrument classes, register transformers, access application memory, read process credentials, and perform arbitrary operations with the application process's operating-system privileges.

Although downloading an observability agent is consistent with the Skill's stated purpose, the unauthenticated delivery channel creates a concrete supply-chain boundary violation.

Attack Path

A user requests Java APM onboarding for an ECS or host deployment.

The Skill presents the documented wget command using an http:// URL.

The user or Agent runs the command from a network where an attacker can intercept or alter plaintext traffic.

T ...[truncated 1003 chars]
Remediation: View remediation
Remediation Suggestions

Replace all public and internal agent URLs with authenticated HTTPS endpoints.

Publish a signed release manifest or trusted SHA-256 digest for every supported agent version.

Download to a controlled temporary location and verify the artifact before extraction:

Reject redirects to unapproved schemes or hosts.

Validate the TLS certificate.

Compare the artifact digest using a fail-closed check.

Prefer a vendor signature whose verification key is distributed independently.

Pin an explicit agent version rather than relying on a mutable object path.

Extract only after verification and validate archive members before writing to /opt.

Abort onboarding if HTTPS or integrity verification is unavailable; do not silently fall back to HTTP.

T09 · Insecure Skill Coding Practices

Warning

Location: references/apm.md:140
Finding: Sensitive APM reporting credential and account-specific identifiers are embedded in documentation
Content: View full analysis
Vulnerability Details

File Location: references/apm.md:140-184
Vulnerability Type: Hardcoded sensitive credential
Risk Level: Medium

Vulnerable Code

markdown
**Example real response** (status=Running means ready):

json
{ "success": true, "data": { "entryPointInfo": { "authToken": "awy7aw18hz@26*44b70", "privateDomain": "proj-xtrace-d1265ec453407aba9ef476c91f84542d-cn-hangzhou.cn-hangzhou-intranet.log.aliyuncs.com", "project": "proj-xtrace-d1265ec453407aba9ef476c91f84542d-cn-hangzhou", "publicDomain": "proj-xtrace-d1265ec453407aba9ef476c91f84542d-cn-hangzhou.cn-hangzhou.log.aliyuncs.com" }, "regionId": "cn-hangzhou", "workspace": "default-cms-1108555361245511-cn-hangzhou" } }

markdown
| `entryPointInfo.authToken` | **LicenseKey** | Agent authentication token (sensitive) | > **Security**: `authToken` is a credential for data reporting. Remind the user not to log or expose it.

Technical Analysis

The file labels the response as a real response and explicitly identifies entryPointInfo.authToken as a sensitive agent authentication credential. Nevertheless, it includes a concrete token alongside an account ID, workspace, project, region, and public reporting endpoint.

Anyone able to obtain the Skill package can read these values without authenticating to the corresponding Alibaba Cloud account. The adjacent warning not to expose the token does not protect a token already committed to the distributed documentation.

The repository does not establish whether the token remains active. The security impact is therefore conditional on its validity, but the disclosure itself is concrete and should be treated as a credential incident.

Attack Path

An unauthorized party downloads or otherwise obtains the Skill package.

The party reads references/apm.md and extracts the embedded authToken, public endpoint, project, workspace, and account-specific identifiers.

...[truncated 980 chars]
Remediation: View remediation
Remediation Suggestions

Immediately revoke or rotate the exposed authToken.

Review telemetry and access records associated with the disclosed workspace and project for unauthorized submissions.

Remove the token and all account-specific identifiers from the current file and repository history.

Replace the example with unmistakably synthetic placeholders, such as:

REDACTED_EXAMPLE_TOKEN

1234567890123456

example-workspace

example-project

Add automated secret scanning to the publication process.

Require security review of documentation fixtures copied from production responses.

Keep the warning about sensitive output, but ensure examples never contain usable credentials.

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: references/apm.md:51
Finding: APM module instructions bypass the project-wide confirmation gate for cloud-side writes
Content: View full analysis
Vulnerability Details

File Location: references/apm.md:51-54, 127-190; duplicated in references/ai.md:20-24, 90-112
Vulnerability Type: Missing authorization confirmation for cloud resource creation
Risk Level: Medium

Vulnerable Code

The module explicitly instructs the Agent to execute cloud-side resource creation without confirmation:

markdown
**Operations that do NOT require confirmation** (execute directly): - Read-only commands: `get`, `list`, `--help`, `describe`, `describe-clusters` - CMS backend resource creation: `apm configuration create`, `apm service create` (these are CMS-side infrastructure, not user application changes) - Retrieving credentials: `apm configuration get`

The affected execution path contains the following write operations:

bash
aliyun cms2 apm configuration create --workspace {workspace} --region {regionId}

bash
aliyun cms2 apm service create --workspace default-cms-{userId}-{regionId} --region {regionId} \ --body @service.json < /dev/null

The AI observability module repeats the same exception:

markdown
**Operations that do NOT require confirmation** (execute directly): - Read-only commands: `get`, `list`, `--help` - CMS backend resource creation: `apm configuration create`, `apm service create` - Retrieving credentials: `apm configuration get` - Fetching addon templates: `integration addon get`

This conflicts with the project-wide requirement in SKILL.md:71:

markdown
**Human confirmation required for writes and high-impact creates**: before any command that creates or changes cloud-side state (`create`, `update`, `delete`, `patch`, `start`, `stop`, etc.), show a concise confirmation summary and the exact command, ask whether the user confirms execution, and wait for a clear affirmative answer.

Technical Analysis

Both apm configuration create and apm service create modify cloud-side state through the user's authenticated Alibaba Cloud CLI identity. The ...[truncated 2162 chars]
Remediation: View remediation
Remediation Suggestions

Remove apm configuration create and apm service create from all no-confirmation lists.

Apply the root confirmation policy consistently across SKILL.md, references/apm.md, and references/ai.md.

Before either command, present:

The exact command.

Region and workspace.

Application service name and type.

Resources expected to be created.

Potential billing, ingestion, and persistence effects.

End the planning turn and wait for an explicit affirmative response before execution.

Preserve the existing no-confirmation behavior only for genuinely read-only commands.

Add a machine-checkable operation classification so module documents cannot silently override the root write policy.

Add regression tests that verify all create, update, delete, patch, start, and stop workflows enforce a confirmation transition before invocation.

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Memory PoisoningPersistent Context Injection, Context Window Stuffing, Memory Manipulation

Findings (77)

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 68)May include surrounding context.
md
ch field's `fieldPath` into nested JSON as specified in [Addon Values Defaults](references/integration-common.md#addon-values-defaults-hard-requirement). Do not

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 72)May include surrounding context.
md
ch field's `fieldPath` into nested JSON as specified in [Addon Values Defaults](references/integration-common.md#addon-values-defaults-hard-requirement). Do not

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 92)May include surrounding context.
md
ch field's `fieldPath` into nested JSON as specified in [Addon Values Defaults](references/integration-common.md#addon-values-defaults-hard-requirement). Do not

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 183)May include surrounding context.
md
ch field's `fieldPath` into nested JSON as specified in [Addon Values Defaults](references/integration-common.md#addon-values-defaults-hard-requirement). Do not

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 189)May include surrounding context.
md
ch field's `fieldPath` into nested JSON as specified in [Addon Values Defaults](references/integration-common.md#addon-values-defaults-hard-requirement). Do not

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 197)May include surrounding context.
md
` | [references/prometheus-management.md](references/prometheus-management.md) |

External Script Fetching

High

Category: Supply Chain
Confidence: 99% confidence
Finding: Piping a remotely fetched script directly into bash creates a high-risk supply-chain and remote code execution path. In this skill context, the danger is amplified because the same section says sensitive parameters such as the ARMS license key, service name, and endpoint are passed to the installer, so a compromised or spoofed script source could execute arbitrary code and capture credentials or alter host/application state.
Content: Scanner excerpt · references/ai.md (reported line 207)May include surrounding context.
md
### OpenClaw / CoPaw / Hermes - 各有专用 installer 脚本（`curl -fsSL ... | bash`），脚本自动安装对应可观测插件 - 参数通过 `--x-arms-license-key`、`--serviceName`、`--endpoint` 传入 - 仅 `opentelemetry` 协议，按 addon 模板输出即可

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · references/ai.md (reported line 8)May include surrounding context.
md
## Scope Guided workflow to onboard server-side applications into CMS Application Monitoring. Uses `aliyun cms2` CLI to initialize APM infrastructure and retrieve access credentials, then generates configuration for the user's specific language and deployment method. **In-Scope**: Initialize APM infra, retrieve LicenseKey/Endpoint, register app services, generate startup configuration for all supported languages, **auto-modify K8s Deployment YAML** (with user confirmation) via `aliyun cs` + `kubectl`.

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · references/apm.md (reported line 8)May include surrounding context.
md
## Scope Guided workflow to onboard server-side applications into CMS Application Monitoring. Uses `aliyun cms2` CLI to initialize APM infrastructure and retrieve access credentials, then generates configuration for the user's specific language and deployment method. **In-Scope**: Initialize APM infra, retrieve LicenseKey/Endpoint, register app services, generate startup configuration for all supported languages, **auto-modify K8s Deployment YAML** (with user confirmation) via `aliyun cs` + `kubectl`.

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · references/apm.md (reported line 20)May include surrounding context.
md
> **CRITICAL** — When the user selects container (ACK/ACS/K8s) onboarding, the following rules are **absolute and non-negotiable**. Violating any of them is a workflow error. 1. **Do NOT ask user for `regionId`**: In container onboarding, `regionId` must be derived automatically from cluster metadata, workspace name, or kubeconfig context. Never prompt the user for region. If derivation fails, use `aliyun cs describe-clusters` output to extract `region_id` from cluster info. 2. **Do NOT run any `integration addon list` or `integration addon get` commands**: Container onboarding uses ack-onepilot component check + workload label patching. Addon discovery is exclusively for non-container (ECS/host) OpenTelemetry scenarios. 3. **Do NOT mention "Addon" to the user**: When asking the user to select onboarding type, use the prompt "请选择接入类型？" (not "请选择接入协议类型？（Addon 类型）" or any variant containing "Addon"). 4. **Do NOT ask user for `network` type**: Container onboarding uses ack-onepilot label injection — there is no agent download URL or endpoint configuration, so public/VPC distinction is irrelevant. Skip the network question entirely.

Credential Access

High

Category: Privilege Escalation
Confidence: 84% confidence
Finding: The skill explicitly retrieves authToken, endpoints, and project data, including a sensitive reporting credential. Although this is legitimate operational behavior, presenting or storing such tokens in plaintext within agent interactions can leak credentials through chat logs, terminal history, or downstream tooling.
Content: Scanner excerpt · references/apm.md (reported line 134)May include surrounding context.
Idempotent — if already initialized, returns successfully. Use apm configuration get to check status.

Step 3 — Retrieve Access Credentials

bash
aliyun cms2 apm configuration get --workspace {workspace} --region {regionId} -o json

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · references/apm.md (reported line 879)May include surrounding context.
md
### Prerequisites - `kubectl` CLI is available locally - AK/SK has ACK cluster read permissions (`cs:DescribeClusters`, `cs:DescribeClusterUserKubeconfig`) - For ack-onepilot method: verify component is installed first. See [ack-onepilot Prerequisites](#prerequisites-install-ack-onepilot-component) for check and installation steps - In container onboarding, do not ask user for `regionId`; derive it automatically from cluster/workspace/context when needed

Credential Access

High

Category: Privilege Escalation
Confidence: 90% confidence
Finding: The workflow explicitly includes obtaining kubeconfig, which is a sensitive cluster credential enabling API access. In the context of an agent skill that may guide or automate actions, this significantly raises the risk of credential misuse, overbroad access, and compromise of Kubernetes workloads if mishandled.
Content: Scanner excerpt · references/apm.md (reported line 885)May include surrounding context.
Workflow

Discover clusters and obtain kubeconfig:

bash
# List ACK clusters to find clusterId (only needed when clusterId is unknown)

Credential Access

High

Category: Privilege Escalation
Confidence: 94% confidence
Finding: Directing retrieval of cluster-user kubeconfig and saving it by default to the common config path risks overwriting existing access configurations and broadening credential exposure. Because kubeconfig often contains tokens, certificates, and endpoints, mishandling can enable full cluster compromise.
Content: Scanner excerpt · references/apm.md (reported line 891)May include surrounding context.
List ACK clusters to find clusterId (only needed when clusterId is unknown)

aliyun cs describe-clusters --region {regionId}

Get kubeconfig for the target cluster (saved to ~/.kube/config by default)

aliyun cs describe-cluster-user-kubeconfig --cluster-id {clusterId} --temporary-duration-minutes 480

text

Credential Access

High

Category: Privilege Escalation
Confidence: 94% confidence
Finding: Directing retrieval of cluster-user kubeconfig and saving it by default to the common config path risks overwriting existing access configurations and broadening credential exposure. Because kubeconfig often contains tokens, certificates, and endpoints, mishandling can enable full cluster compromise.
Content: Scanner excerpt · references/apm.md (reported line 891)May include surrounding context.
List ACK clusters to find clusterId (only needed when clusterId is unknown)

aliyun cs describe-clusters --region {regionId}

Get kubeconfig for the target cluster (saved to ~/.kube/config by default)

aliyun cs describe-cluster-user-kubeconfig --cluster-id {clusterId} --temporary-duration-minutes 480

text

Credential Access

High

Category: Privilege Escalation
Confidence: 93% confidence
Finding: The statement that kubeconfig is saved to ~/.kube/config by default normalizes storage of sensitive credentials in a shared default path. In a multi-cluster or shared workstation environment, this can expose or overwrite privileged contexts and increase the blast radius of any local compromise.
Content: Scanner excerpt · references/apm.md (reported line 892)May include surrounding context.
aliyun cs describe-clusters --region {regionId}

Get kubeconfig for the target cluster (saved to ~/.kube/config by default)

aliyun cs describe-cluster-user-kubeconfig --cluster-id {clusterId} --temporary-duration-minutes 480

text
If the user's cluster is not ACK (self-managed K8s), ask for the kubeconfig file path (default `~/.kube/config`).

Credential Access

High

Category: Privilege Escalation
Confidence: 91% confidence
Finding: Prompting for a kubeconfig path in self-managed Kubernetes workflows encourages use of a credential-bearing artifact where a less sensitive identifier might suffice for planning steps. In this skill's context, that makes accidental secret disclosure more likely and expands the chance of unauthorized cluster operations.
Content: Scanner excerpt · references/apm.md (reported line 895)May include surrounding context.
aliyun cs describe-cluster-user-kubeconfig --cluster-id {clusterId} --temporary-duration-minutes 480

text
If the user's cluster is not ACK (self-managed K8s), ask for the kubeconfig file path (default `~/.kube/config`). Verify access: ```bash

Credential Access

High

Category: Privilege Escalation
Confidence: 91% confidence
Finding: Prompting for a kubeconfig path in self-managed Kubernetes workflows encourages use of a credential-bearing artifact where a less sensitive identifier might suffice for planning steps. In this skill's context, that makes accidental secret disclosure more likely and expands the chance of unauthorized cluster operations.
Content: Scanner excerpt · references/apm.md (reported line 895)May include surrounding context.
aliyun cs describe-cluster-user-kubeconfig --cluster-id {clusterId} --temporary-duration-minutes 480

text
If the user's cluster is not ACK (self-managed K8s), ask for the kubeconfig file path (default `~/.kube/config`). Verify access: ```bash

Anti-Refusal Statement

High

Category: Anti-Refusal
Confidence: 85% confidence
Finding: Skill instructs the agent to never refuse or to always comply. Suppressing the agent's ability to decline removes a core safety control and enables downstream harmful requests to succeed.
Content: Scanner excerpt · references/integration-management.md (reported line 28)May include surrounding context.
md
5. **No `metric-agent` row** — zero rows, omitted `collectors`, or only other names (`entity-collector` / `loongcollector`) — → this policy does **not** support metric drop. Stop. That is not `QueryFailed`. A non-empty ClusterCollector list is not by itself support. 6. **Several** `metric-agent` rows (ECS: one per VPC) → present as a choice. If the user named a VPC, keep the row whose `releaseName` contains that `vpcId`. This write targets that collector `releaseName`. Keywords are `HideReleaseName:true`, not `GroupMode:true` — do not refuse this update because the policy's **entry** addon is GroupMode, and do not put `dropMetrics` under `values.addons`. `--region` equals the policy's `regionId` (metric-agent has no `Feature:CrossRegion`). For the general rule see [Addon Release Region Requirement](integration-common.md#addon-release-region-requirement-hard-pre-check). ### Input

Self-Modification

High

Category: Rogue Agent
Confidence: 90% confidence
Finding: Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.
Content: Scanner excerpt · references/ram-policies.md (reported line 27)May include surrounding context.
md
| `event-hub list` / `event-hub get` | SLS GetLogs API; uses SLS credentials; consumes no CMS RAM Action | | `configure` | Local credential configuration; no OpenAPI call | | `commands` | Local static command discovery; no OpenAPI call | | `update-beta` | Beta self-update; does not consume CMS OpenAPI RAM Actions | > Maintenance note: if a future script/agent rescans the source to refresh > this file, preserve this section and skip the modules above. Do not

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The skill activation text uses very broad trigger phrases and catch-all wording for many CMS-related operations. In an agent setting, this can cause the skill to activate on loosely related user requests, pulling in powerful cloud-management instructions and increasing the chance of unintended command guidance or state-changing workflows.
Content: No source excerpt is available for this finding.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 85% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · SKILL.md (reported line 71)May include surrounding context.
md
- **Addon-release `values`**: expand each field's `fieldPath` into nested JSON as specified in [Addon Values Defaults](references/integration-common.md#addon-values-defaults-hard-requirement). Do not write a dotted `fieldPath` as one literal key. How to pick `--env-type`, where child fields sit on create vs update, and when a subset is (or is not) a valid body, are in that section. - **Region parameter required for mutating and detail commands**: unless otherwise specified by a module-specific rule, all `create`, `update`, `delete`, and single-resource `get`/detail commands MUST include the `--region` parameter so the request is routed to the correct backend OpenAPI endpoint. Omitting `--region` on these commands may cause routing failures or operate against an unintended region, and the error can name something else entirely — `integration policy create` returns `status 400: The workspace can not be created` even when the workspace exists and the body is valid. This does not apply to `list`/query commands that intentionally span multiple regions (e.g. `entity query --source CloudResource` all-region queries). Requiring the flag is not permission to choose its value — resolve it per [Region Confirmation Gate](#region-confirmation-gate-hard-requirement). - **One choice, one question**: every enumerated choice (region, workspace, policy, addon, scope mode, tag match mode, and any other mutually exclusive parameter) is asked as one question carrying **all** of its options. Never split them across questions or into a `（续）...` continuation, and never drop the ones that do not fit — a split turns one choice into two answers that can conflict or be left incomplete, and a truncated list hides valid choices entirely. When the structured input form cannot render every option, ask as plain text and spell out every option with its explanation in the question body. A mutually exclusive choice stays single-select; only a genuinely multi-valued one (several regions) is multi-selec ...[truncated 26 chars]

Context Window Stuffing

Medium

Category: Memory Poisoning
Confidence: 80% confidence
Finding: Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.
Content: Scanner excerpt · SKILL.md (reported line 187)May include surrounding context.
md
## Module Routing | User Intent Keywords | Commands | Module | |------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|----------|--------| | onboarding, monitoring addon, policy, integration, addon release, integration resource, Kubernetes resource list, Namespace resources under policy, resources managed by policy, teardown, offboarding — **common rules, load for every onboarding operation** | `integration` `integration resource` | [references/integration-common.md](references/integration-common.md) | | container onboarding, ACK/ACS/ASI cluster onboarding, cluster fleet audit, which clusters are not onboarded | `integration` `entity query` | [references/cs-onboarding.md](references/cs-onboarding.md) (+ integration-common.md) |

Context Window Stuffing

Medium

Category: Memory Poisoning
Confidence: 80% confidence
Finding: Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.
Content: Scanner excerpt · SKILL.md (reported line 191)May include surrounding context.
md
## Module Routing | User Intent Keywords | Commands | Module | |------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|----------|--------| | onboarding, monitoring addon, policy, integration, addon release, integration resource, Kubernetes resource list, Namespace resources under policy, resources managed by policy, teardown, offboarding — **common rules, load for every onboarding operation** | `integration` `integration resource` | [references/integration-common.md](references/integration-common.md) | | container onboarding, ACK/ACS/ASI cluster onboarding, cluster fleet audit, which clusters are not onboarded | `integration` `entity query` | [references/cs-onboarding.md](references/cs-onboarding.md) (+ integration-common.md) |

Context Window Stuffing

Medium

Category: Memory Poisoning
Confidence: 80% confidence
Finding: Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.
Content: Scanner excerpt · SKILL.md (reported line 205)May include surrounding context.
md
## Module Routing | User Intent Keywords | Commands | Module | |------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|----------|--------| | onboarding, monitoring addon, policy, integration, addon release, integration resource, Kubernetes resource list, Namespace resources under policy, resources managed by policy, teardown, offboarding — **common rules, load for every onboarding operation** | `integration` `integration resource` | [references/integration-common.md](references/integration-common.md) | | container onboarding, ACK/ACS/ASI cluster onboarding, cluster fleet audit, which clusters are not onboarded | `integration` `entity query` | [references/cs-onboarding.md](references/cs-onboarding.md) (+ integration-common.md) |

Overview

A.I.G

T08 · Insecure Dependencies

Vulnerability Details

Vulnerable Code

Technical Analysis

Attack Path

Remediation Suggestions

T09 · Insecure Skill Coding Practices

Vulnerability Details

Vulnerable Code

Technical Analysis

Attack Path

Remediation Suggestions

T05 · Unauthorized Access and Privilege Escalation

Vulnerability Details

Vulnerable Code

Technical Analysis

Remediation Suggestions

SkillSpector

Ae1

Ae1

Ae1

Ae1

Ae1

Ae1

External Script Fetching

Credential Access

Credential Access

Credential Access

Credential Access

Step 3 — Retrieve Access Credentials

Credential Access

Credential Access

Workflow

Credential Access

List ACK clusters to find clusterId (only needed when clusterId is unknown)

Get kubeconfig for the target cluster (saved to ~/.kube/config by default)

Credential Access

List ACK clusters to find clusterId (only needed when clusterId is unknown)

Get kubeconfig for the target cluster (saved to ~/.kube/config by default)

Credential Access

Get kubeconfig for the target cluster (saved to ~/.kube/config by default)

Credential Access

Credential Access

Anti-Refusal Statement

Self-Modification

Vague Triggers

Autonomous Decision Making

Context Window Stuffing

Context Window Stuffing

Context Window Stuffing